CVE-2026-15953 describes a CWE-22 path traversal vulnerability in ABB Protection and control IED manager (PCM600) versions up to and including 2.14. The vulnerability involves improper limitation of a pathname to a restricted directory, which could allow an attacker with local privileges and user interaction to modify files outside the intended directory. The CVSS 3.1 vector indicates low attack vector (local), low attack complexity, low privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with local access and the ability to interact with the application could exploit this vulnerability to modify files outside of the intended directory, potentially leading to unauthorized changes to system or application files. There is no confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Until a patch is available, restrict local access to trusted users and monitor for suspicious activity related to file modifications.